k8s/iam: add cloudnativepg postgres and vault + authentik

- PostgreSQL 3-replica HA with pgvector
- Vault S3 storage backend (MinIO)
- Authentik federated OIDC provider
- Vault auto-unseal via postStart hook

k8s/ddb/init-users.sql

@@ -0,0 +1,11 @@
+-- Database initialization for homelab applications
+-- Idempotent: safe to re-run
+-- Required environment variables:
+--   AUTHENTIK_PG_PASSWORD
+--   STORY_CRATER_PG_PASSWORD
+
+CREATE ROLE IF NOT EXISTS authentik WITH LOGIN PASSWORD :'authentik_password';
+CREATE DATABASE IF NOT EXISTS authentik OWNER authentik;
+
+CREATE ROLE IF NOT EXISTS story_crater WITH LOGIN PASSWORD :'story_crater_password';
+CREATE DATABASE IF NOT EXISTS story_crater OWNER story_crater;